Method of dormant data session reactivation

ABSTRACT

A method for dormant data session reactivation may include a packet control function ( 118 ) in a radio access network ( 104 ) receiving a first data packet ( 150 ) having a source IP address ( 152 ), where the first data packet has a destination IP address ( 152 ) addressed to reactivate a dormant mobile station ( 102 ) coupled to the radio access network. The packet control function may receive a plurality of subsequent data packets ( 160 ) having the source IP address, where each of the plurality of subsequent data packets has a subsequent destination IP address ( 162, 164, 166 ) and a corresponding time stamp ( 163, 165, 167 ). For each of the subsequent destination IP addresses that are substantially sequential, evaluating an absolute value of a slope ( 270 ) of the difference between the subsequent destination IP addresses that are substantially sequential over a difference in the corresponding time stamps. If the absolute value of the slope is less than a threshold function ( 280 ), denying the first data packet and preventing reactivation of the dormant mobile station by the first data packet.

BACKGROUND OF INVENTION

In cellular network systems, particularly CDMA cellular networks, amobile station may be in a dormant state, where the cellular network isaware of the mobile station on the system, but currently, there is noactivity with the mobile station. In other words, the mobile station isregistered with the cellular network, but in a dormant data session asno active communication sessions are taking place. An example of this isa mobile station that is registered and has been active in the cellularnetwork, but is currently inactive without having powered off, such as amobile station in a push-to-talk session, a mobile station awaiting apaging request, and the like.

In prior art CDMA cellular networks, Internet users may cause abnormallyhigh paging rates by implementing malicious Internet Protocol (IP) scansthat can overload the cellular network system. These malicious IP scansare often implemented to search for mobile stations in a dormant datasession in order to reactivate them. The prior art is deficient indistinguishing these malicious users of the cellular network system fromlegitimate users.

There is a need, not met in the prior art, for a method of dormant datasession reactivation. Accordingly, there is a significant need for anapparatus and method that overcomes the deficiencies of the prior artoutlined above.

BRIEF DESCRIPTION OF THE DRAWINGS

Representative elements, operational features, applications and/oradvantages of the present invention reside inter alia in the details ofconstruction and operation as more fully hereafter depicted, describedand claimed—reference being made to the accompanying drawings forming apart hereof, wherein like numerals refer to like parts throughout. Otherelements, operational features, applications and/or advantages willbecome apparent in light of certain exemplary embodiments recited in theDetailed Description, wherein:

FIG. 1 representatively illustrates a wireless communication system inaccordance with an exemplary embodiment of the present invention;

FIG. 2 representatively illustrates a graphical representation ofsubsequent destination IP addresses plotted against corresponding timestamps in accordance with an exemplary embodiment of the presentinvention;

FIG. 3 representatively illustrates a graphical representation ofsubsequent destination IP addresses plotted against corresponding timestamps in accordance with another exemplary embodiment of the presentinvention;

FIG. 4 representatively illustrates flow diagram in accordance with anexemplary embodiment of the present invention; and

FIG. 5 representatively illustrates flow diagram in accordance withanother exemplary embodiment of the present invention.

Elements in the Figures are illustrated for simplicity and clarity andhave not necessarily been drawn to scale. For example, the dimensions ofsome of the elements in the Figures may be exaggerated relative to otherelements to help improve understanding of various embodiments of thepresent invention. Furthermore, the terms “first”, “second”, and thelike herein, if any, are used inter alia for distinguishing betweensimilar elements and not necessarily for describing a sequential orchronological order. Moreover, the terms “front”, “back”, “top”,“bottom”, “over”, “under”, and the like in the Description and/or in theClaims, if any, are generally employed for descriptive purposes and notnecessarily for comprehensively describing exclusive relative position.Any of the preceding terms so used may be interchanged under appropriatecircumstances such that various embodiments of the invention describedherein may be capable of operation in other configurations and/ororientations than those explicitly illustrated or otherwise described.

DETAILED DESCRIPTION OF EXEMPLARY EMBODIMENTS

The following representative descriptions of the present inventiongenerally relate to exemplary embodiments and the inventor's conceptionof the best mode, and are not intended to limit the applicability orconfiguration of the invention in any way. Rather, the followingdescription is intended to provide convenient illustrations forimplementing various embodiments of the invention. As will becomeapparent, changes may be made in the function and/or arrangement of anyof the elements described in the disclosed exemplary embodiments withoutdeparting from the spirit and scope of the invention.

A detailed description of an exemplary application, namely a method ofdormant data session reactivation, is provided as a specific enablingdisclosure that may be generalized to any application of the disclosedsystem, device and method in accordance with various embodiments of thepresent invention.

Wireless communication systems are well known and consist of many typesincluding land mobile radio, cellular radiotelephone (inclusive ofanalog cellular, digital cellular, personal communication systems (PCS)and wideband digital cellular systems), and other communication systemtypes. In cellular radiotelephone communication systems, for example, anumber of communication cells are typically comprised of one or moreBase Transceiver Stations (BTS's) coupled to one or more Base StationControllers (BSCs) or Central Base Station Controllers (CBSCs) andforming a Radio Access Network (RAN). The BSCs or CBSCs are, in turn,coupled to a Mobile Switching Center (MSC) that provides a connectionbetween the RAN and an external network, such as a Public SwitchedTelephone Network (PSTN), as well as interconnection to other RANs. EachBTS provides communication services to a mobile station (MS) located ina coverage area serviced by the BTS via a communication resource thatincludes a forward link for transmitting signals to, and a reverse linkfor receiving signals from, the MS.

FIG. 1 representatively illustrates a wireless communication system 100in accordance with an exemplary embodiment of the present invention.Wireless communication system 100 includes a RAN 104 comprising multipleBTSs 106-108 that are each coupled to a CBSC 110. RAN 104 is coupled toan MSC 114, and MSC 114 is in turn coupled to an external network 116and provides a communication link between the external network, or otherRANs, and RAN 104. In an embodiment, RAN 104 is a CDMA network.

Wireless communication system 100 further includes a mobile station 102,103, 105 that is in a dormant data session with a BTS 106, 107, 108.That is, mobile station 102, for example, is not in an activecommunication session with BTS 106, but is powered-up, registered andmay have been recently in an active communication session with BTS 106.While RAN 104 is aware of mobile station 102, no active communication iscurrently occurring between mobile station 102 and RAN 104. In a dormantdata session, mobile station 102 is a dormant mobile station, which isregistered with RAN 104 and coupled to send or receive data via wirelesslink 120. Each communication link 120, 130, 140 includes a respectiveforward link for conveyance of signals to mobile station 102 and arespective reverse link for receipt of signals from the mobile station102. Either mobile station 102 receiving a data packet via RAN 104, or auser of mobile station 102 sending a data packet may reactivate dormantdata session. Any number of mobile stations 102, 103, 105 may be coupledto RAN 104 and be in a dormant data session.

CBSC 110 may also include Packet Control Function (PCF) 118. In anembodiment, PCF 118 is coupled to communicate packet data, particularlyIP packet data, between the mobile station 102, and the Packet DataServing Node (PDSN) 139 over an A10/A11 interface. Packet controlfunction 118 may operate to maintain a reachable state between RAN 104and mobile station 102, ensuring a consistent link for data packets,buffering of data packets arriving from PDSN 139 when wireless linkresources are not in place or are insufficient to support the flow fromPDSN 139, and relay data packets between the mobile station 102 and PDSN139.

PDSN 139 may be coupled to operate as the gateway from the RAN 104 intoa public and/or private packet network, for example and withoutlimitation, the Internet 113. In an embodiment, PDSN 139 may act as anetwork access server, home agent, foreign agent, and the like. PDSN 139may manage the radio-packet interface between RAN 104 and Internet 113,provide IP addresses for the subscriber's mobile station 102, 103, 105,perform packet routing, actively manage subscriber services based onprofile information, authenticate users, and the like.

In an embodiment, PCF 118 may be coupled to receive incoming datapackets addressed to a dormant mobile station 102. In other words, PCF118 may be coupled to receive incoming data packets addressed toreactivate a dormant data session with mobile station 102. Such incomingdata packets may originate from a packet data network external to RAN104, such as users connected to the Internet 113, and the like. As anexample, incoming data packets may be incoming data coupled with apush-to-talk session, paging request, and the like. For example, mobilestation 102 may be registered with RAN 104 but have no currently activedata sessions in progress, i.e. mobile station 102 is in a dormant datasession. The arrival of a data packet, for example as part of a pagingrequest, may operate to reactivate dormant data session by reactivatingdormant mobile station 102.

In an embodiment, PCF 118 is coupled to examine incoming data packetsand determine if reactivation of a dormant data session with a dormantmobile station is permitted. In an exemplary embodiment, PCF may scanincoming data packets, including source IP addresses and destination IPaddresses to determine if an incoming data packet is the product of amalicious IP scan or from a legitimate user.

In an illustrative embodiment, a first data packet 150 is received byPCF 118 via PDSN 139. First data packet 150 may have a source IP address152 and a destination IP address 154. The source IP address 152 is anindication of the origination of the first data packet 150, while thedestination IP address 154 may be coupled to reactivate dormant mobilestation 102. In other words, first data packet 150 is addressed toreactivate a dormant data session with dormant mobile station 102. Thiscan be, for example, a paging request, and the like.

After receiving first data packet 150, PCF 118 may receive a pluralityof subsequent data packets 160. PCF 118 may categorize each of pluralityof subsequent data packets 160 based on their source IP address. In anembodiment, if plurality of subsequent data packets 160 each have thesame source IP address 152 as first data packet 150, this may be anindication of a malicious IP scan. Although three subsequent datapackets 160 are shown, any number of plurality of subsequent datapackets 160 are within the scope of the invention.

Plurality of subsequent data packets 160 each have a subsequentdestination IP address 162, 164, 166 and a corresponding time stamp 163,165, 167 of when they were received by PCF 118. In an embodiment, foreach of the subsequent data packets 160 that have the same source IPaddress 152 as first data packet 150, PCF 118 may compare each of theplurality of subsequent destination IP addresses 162, 164, 166 andcorresponding time stamps 163, 165, 167 to decide if first data packet150 is permitted to reactivate dormant mobile station 102. If pluralityof destination IP addresses 162, 164, 166 is substantially sequential,this is an indication that plurality of subsequent data packets 160 maybe the product of a malicious IP scan. In other words, if PCF 118receives plurality of subsequent data packets 160 from the same sourceIP address 152 and having a plurality of subsequent destination IPaddresses 162, 164, 166 that are substantially sequential, although notnecessarily consecutive, this may be an indication of a malicious IPscan.

As an example of an embodiment, plurality of subsequent destination IPaddresses 162, 164, 166 may be substantially sequential, although notnecessarily consecutive, in an increasing or decreasing pattern and bewithin the scope of the invention.

In an embodiment, PCF 118 may convert each of subsequent destination IPaddresses into an ordinal numeric representation. An IP address is in a32-bit format grouped eight bits at a time (an octet), separated bydots, and represented in decimal format (known as dotted decimalnotation). Each bit in the octet has a binary weight (128, 64, 32, 16,4, 2, 1). The minimum value for an octet is 0 and the maximum value foran octet is 255. As an example, plurality of subsequent data packets 160having a plurality of subsequent destination IP addresses 162, 164, 166that are substantially sequential, may be converted to an ordinalnumeric representation such as 1, 2, 4, 5, 7, 8 . . . . or 10, 9, 7, 6,4, 3 . . . , and the like.

In an embodiment, plurality of subsequent destination IP addresses 162,164, 166 may be compared for the spread between them along with thedifference in their corresponding time stamps 163, 165, 167. Thecomparison between each of plurality of subsequent data packets 160 thatare subsequent to first data packet 150 may take place sequentially ornon-sequentially.

FIG. 2 representatively illustrates a graphical representation 200 ofsubsequent destination IP addresses plotted against corresponding timestamps in accordance with an exemplary embodiment of the presentinvention. In the graph of FIG. 2, plurality of subsequent destinationIP addresses 162, 164, 166 (these are representative as there are manymore shown) have been converted to an ordinal numeric representation andplotted against their corresponding time stamps.

Although the exemplary embodiment of FIG. 2 shows plurality ofsubsequent destination IP addresses as being sequential and henceplotting as a tight linear function, deviations from this (fuzziness inthe plot) are within the scope of the invention. For example, pluralityof subsequent destination IP addresses plotted against theircorresponding time stamps may not form a precise linear function and bewithin the scope of the invention. Plurality of subsequent destinationIP addresses need only be substantially sequential, although notnecessarily consecutive, to be within the scope of the invention.

In an embodiment, if at least a portion of subsequent destination IPaddresses 162, 164, 166 are substantially sequential, and if an absolutevalue of a difference between each of the at least a portion ofsubsequent destination IP addresses 162, 164, 166 for a given differencein corresponding time stamps 163, 165, 167 is less than a thresholdfunction 280, PCF 118 may deny the first data packet 150. In otherwords, for each of the subsequent destination IP addresses that aresubstantially sequential, PCF 118 may evaluate an absolute value of aslope 270 of the difference between the subsequent destination IPaddress over a difference in the corresponding time stamps. If theabsolute value of the slope is less than a threshold function 280, thefirst data packet 150 may be denied, thereby preventing the first datapacket 150 from reactivating the dormant mobile station 102.

This may be represented in another way as follows. For (n) plurality ofsubsequent data packets having a source IP address 152 the same as firstdata packet 150 the following may be evaluated:

Absolute value of theslope=abs[(IPdest(n)−IPdest(n−1))]/[timestamp(n)−timestamp(n−1)], whereabs=absolute value function, IPdest(n) and IPdest(n−1)=subsequentdestination IP address of subsequent data packet (n) and (n−1)respectively, and timestamp(n) and timestamp (n−1)=timestamp of arrivalfor subsequent data packet (n) and (n−1) respectively.

If the absolute value of the slope 270 is less than threshold function280, first data packet 150 may be denied and discarded by PCF 118.Threshold function 280 may be any value or function set by one skilledin the art for a particular application that indicates a substantiallylinear IP scan in a given period of time. In other words, if PCF 118detects a given source IP address sending a series of data packetshaving substantially sequential destination IP addresses in a given timeperiod, PCF 118 may elect to deny the first data packet 150 and preventreactivation of dormant mobile station 102. This may indicate a lack ofsufficient randomness, or entropy, in plurality of subsequentdestination IP addresses from a source IP address 152. First data packet150 may then be deemed part of a malicious IP scan instead of alegitimate request for reactivation of a dormant data session. In anembodiment, PCF 118 may further elect to deny plurality of subsequentdata packets 160 having source IP address 152 based on the abovecriteria.

In an embodiment, if the absolute value of the slope 270 is not lessthan threshold function 280, PCF 118 may permit first data packet 150 toreach dormant mobile station 102 and reactivate a dormant data session.In other words, a base transceiver station (BTS) service request may besent to MSC. As an example of an embodiment, if absolute value of slope270 is not less than threshold function 280, it may be an indication ofsufficient randomness (i.e. entropy) of the plurality of subsequentdestination IP addresses to indicate that plurality of subsequent datapackets 160 are not the product of a malicious IP scan.

Although FIG. 2 illustrates a plot of substantially sequential pluralityof subsequent destination IP addresses increasing, this is not limitingof the invention. As one skilled in the art is aware, depending on theordinal numeric representation given to each of the plurality ofsubsequent destination IP addresses, the plot may return a positive ornegative slope. The positive slope shown in FIG. 2 is representative.However, evaluating the absolute value of the slope will return apositive number and if the absolute value of the slope 270 is less thana threshold function 280, then first data packet 150 may be permitted toreach dormant mobile station 102, or a base transceiver station (BTS)service request may be sent to MSC.

FIG. 3 representatively illustrates a graphical representation 300 ofsubsequent destination IP addresses plotted against corresponding timestamps in accordance with another exemplary embodiment of the presentinvention. As shown in FIG. 3, plurality of subsequent destination IPaddresses 162, 164, 166 (these are representative as there are many moreshown) have been converted to an ordinal numeric representation andplotted against their corresponding time stamps. FIG. 3 is the samerepresentation as shown in FIG. 2, with the addition of a secondthreshold function 382.

In an embodiment, if a at least a portion of subsequent destination IPaddresses 162, 164, 166 are substantially sequential, and if an absolutevalue of a difference between each of the at least a portion ofsubsequent destination IP addresses 162, 164, 166 for a given differencein corresponding time stamps 163, 165, 167 is less than a thresholdfunction 380 and greater than a second threshold function 382, PCF 118may deny the first data packet 150. In other words, for each of thesubsequent destination IP addresses that are substantially sequential,PCF 118 may evaluate an absolute value of a slope 370 of the differencebetween the subsequent destination IP address over a difference in thecorresponding time stamps. If the absolute value of the slope is lessthan a threshold function 380 and greater than a second thresholdfunction 382, the first data packet 150 may be denied and discarded,thereby preventing the first data packet from reactivating the dormantmobile station 102.

If the absolute value of the slope 370 is less than threshold function380 and greater than second threshold function 382, first data packet150 may be denied by PCF 118. Threshold function 380 and secondthreshold function 382 may be any values or functions set by one skilledin the art for a particular application that indicates a substantiallylinear IP scan in a given period of time. In other words, if PCF 118detects a given source IP address sending a series of data packetshaving substantially sequential destination IP addresses in a given timeperiod, PCF 118 may elect to deny the first data packet 150 and preventreactivation of dormant mobile station 102. This may indicate a lack ofsufficient randomness, or entropy, in plurality of subsequentdestination IP addresses from a source IP address 152. First data packet150 may then be deemed part of a malicious IP scan instead of alegitimate request for reactivation of a dormant data session. In anembodiment, PCF 118 may further elect to deny plurality of subsequentdata packets 160 having source IP address 152 based on the abovecriteria.

In an embodiment, if the absolute value of the slope 370 is not lessthan threshold function 380 or is less than second threshold function382, PCF 118 may permit first data packet 150 to reach dormant mobilestation 102 and reactivate a dormant data session. In other words, abase transceiver station (BTS) service request may be sent to MSC. As anexample of an embodiment, if absolute value of slope 370 is not lessthan threshold function 380, it may be an indication of sufficientrandomness (i.e. entropy) of the plurality of subsequent destination IPaddresses to indicate that plurality of subsequent data packets 160 arenot the product of a malicious IP scan. If absolute value of slope 370is less than second threshold function 382, it may be an indication of apush-to-talk session or other legitimate communication session takingplace over a sufficient time period as to not indicate a malicious IPscan.

FIG. 4 representatively illustrates flow diagram 400 in accordance withan exemplary embodiment of the present invention. In step 402, PCFreceives first data packet having a source IP address and a destinationIP address, where the destination IP address is to a dormant mobilestation. In other words, first data packet is addressed to reactivate amobile station in a dormant data session.

In step 404, PCF receives a plurality of subsequent data packets havingthe same source IP address as first data packet, and a plurality ofsubsequent destination IP addresses and corresponding time stamps. Instep 406, PCF compares plurality of subsequent destination IP addressesand corresponding time stamps for sufficient randomness, or entropy, toindicate that first data packet is from a legitimate user and not partof a malicious IP scan.

In step 408, for each of the subsequent destination IP addresses thatare substantially sequential, PCF evaluates an absolute value of a slopeof the difference between the subsequent destination IP address over adifference in the corresponding time stamps. If the absolute value ofthe slope is less than a threshold function, the first data packet maybe denied, thereby preventing the first data packet from reactivatingthe dormant mobile station per step 414. Optionally, plurality ofsubsequent data packets may be denied entry into RAN as well per step416.

If the an absolute value of a slope of the difference between thesubsequent destination IP address over a difference in the correspondingtime stamps is not less than the threshold function per step 408, PCFmay send the first data packet to dormant mobile station per step 410,thereby reactivating dormant mobile station per step 412.

FIG. 5 representatively illustrates flow diagram in accordance withanother exemplary embodiment of the present invention. In step 502, PCFreceives first data packet having a source IP address and a destinationIP address, where the destination IP address is to a dormant mobilestation. In other words, first data packet is addressed to reactivate amobile station in a dormant data session.

In step 504, PCF receives a plurality of subsequent data packets havingthe same source IP address as first data packet, and a plurality ofsubsequent destination IP addresses and corresponding time stamps. Instep 506, PCF compares plurality of subsequent destination IP addressesand corresponding time stamps for sufficient randomness, or entropy, toindicate that first data packet is from a legitimate user and not partof a malicious IP scan.

In step 508, for each of the subsequent destination IP addresses thatare substantially sequential, PCF evaluates an absolute value of a slopeof the difference between the subsequent destination IP address over adifference in the corresponding time stamps. If the absolute value ofthe slope is less than a threshold function, it is determined if anabsolute value of a slope of the difference between the subsequentdestination IP address over a difference in the corresponding timestamps is greater than a second threshold function per step 514. If so,the first data packet may be denied, thereby preventing the first datapacket from reactivating the dormant mobile station per step 516.Optionally, plurality of subsequent data packets may be denied entryinto RAN as well per step 518.

If the an absolute value of a slope of the difference between thesubsequent destination IP address over a difference in the correspondingtime stamps is not less than the threshold function per step 508, PCFmay send the first data packet to dormant mobile station per step 510,thereby reactivating dormant mobile station per step 512.

If the an absolute value of a slope of the difference between thesubsequent destination IP address over a difference in the correspondingtime stamps is not greater than the second threshold function per step514, PCF may send the first data packet to dormant mobile station perstep 520, thereby reactivating dormant mobile station per step 522.

In the foregoing specification, the invention has been described withreference to specific exemplary embodiments; however, it will beappreciated that various modifications and changes may be made withoutdeparting from the scope of the present invention as set forth in theclaims below. The specification and figures are to be regarded in anillustrative manner, rather than a restrictive one and all suchmodifications are intended to be included within the scope of thepresent invention. Accordingly, the scope of the invention should bedetermined by the claims appended hereto and their legal equivalentsrather than by merely the examples described above.

For example, the steps recited in any method or process claims may beexecuted in any order and are not limited to the specific orderpresented in the claims. Additionally, the components and/or elementsrecited in any apparatus claims may be assembled or otherwiseoperationally configured in a variety of permutations to producesubstantially the same result as the present invention and areaccordingly not limited to the specific configuration recited in theclaims.

Benefits, other advantages and solutions to problems have been describedabove with regard to particular embodiments; however, any benefit,advantage, solution to problem or any element that may cause anyparticular benefit, advantage or solution to occur or to become morepronounced are not to be construed as critical, required or essentialfeatures or components of any or all the claims.

As used herein, the terms “comprise”, “comprises”, “comprising”,“having”, “including”, “includes” or any variation thereof, are intendedto reference a non-exclusive inclusion, such that a process, method,article, composition or apparatus that comprises a list of elements doesnot include only those elements recited, but may also include otherelements not expressly listed or inherent to such process, method,article, composition or apparatus. Other combinations and/ormodifications of the above-described structures, arrangements,applications, proportions, elements, materials or components used in thepractice of the present invention, in addition to those not specificallyrecited, may be varied or otherwise particularly adapted to specificenvironments, manufacturing specifications, design parameters or otheroperating requirements without departing from the general principles ofthe same.

1. A method for dormant data session reactivation, comprising: a packetcontrol function in a radio access network receiving a first data packethaving a source IP address, wherein the first data packet has adestination IP address coupled to reactivate a dormant mobile stationcoupled to the radio access network; the packet control functionreceiving a plurality of subsequent data packets having the source IPaddress, wherein each of the plurality of subsequent data packets has asubsequent destination IP address and a corresponding time stamp; foreach of the plurality of subsequent data packets, the packet controlfunction comparing the subsequent destination IP address and thecorresponding time stamp; and if at least a portion of the subsequentdestination IP addresses are substantially sequential, and if anabsolute value of a difference between each of the at least a portion ofsubsequent destination IP addresses that are sequential for a givendifference in the corresponding time stamps is less than a thresholdfunction, denying the first data packet.
 2. The method of claim 1,further comprising if at least a portion of the subsequent destinationIP addresses are substantially sequential and if the absolute value ofthe difference between each of the at least a portion of subsequentdestination IP addresses that are sequential for a given difference inthe corresponding time stamps is less than a threshold function andgreater than a second threshold function, denying the first data packet.3. The method of claim 1, wherein denying the first data packetcomprises preventing the first data packet from reactivating the dormantmobile station.
 4. The method of claim 1, wherein comparing theplurality of subsequent IP packets and the corresponding time stampscomprises, for each of the at least a portion of the subsequentdestination IP addresses that are substantially sequential, evaluatingan absolute value of a slope of the difference between the subsequentdestination IP addresses that are substantially sequential over adifference in the corresponding time stamps.
 5. The method of claim 1,wherein the radio access network is a CDMA network.
 6. The method ofclaim 1, further comprising converting each of the subsequentdestination IP addresses into an ordinal numeric representation.
 7. Themethod of claim 1, further comprising if at least a portion of thesubsequent destination IP addresses are substantially sequential and ifan absolute value of a difference between each of the at least a portionof subsequent destination IP addresses that are substantially sequentialfor a given difference in the corresponding time stamps is less than athreshold function, denying the plurality of subsequent data packets. 8.A method for dormant data session reactivation, comprising: a packetcontrol function in a radio access network receiving a first data packethaving a source IP address, wherein the first data packet has adestination IP address coupled to reactivate a dormant mobile stationcoupled to the radio access network; the packet control functionreceiving a plurality of subsequent data packets having the source IPaddress, wherein each of the plurality of subsequent data packets has asubsequent destination IP address and a corresponding time stamp; foreach of the subsequent destination IP addresses that are substantiallysequential, evaluating an absolute value of a slope of the differencebetween the subsequent destination IP addresses that are substantiallysequential over a difference in the corresponding time stamps; and ifthe absolute value of the slope is less than a threshold function,denying the first data packet.
 9. The method of claim 8, wherein if theabsolute value of the slope is not less than the threshold function,sending the first packet to the dormant mobile station.
 10. The methodof claim 8, wherein if the absolute value of the slope is less than athreshold function and greater than a second threshold function, denyingthe first data packet.
 11. The method of claim 8, wherein denying thefirst data packet comprises preventing the first data packet fromreactivating the dormant mobile station.
 12. The method of claim 8,wherein the radio access network is a CDMA network.
 13. The method ofclaim 8, further comprising converting each of the subsequentdestination IP addresses into an ordinal numeric representation.
 14. Themethod of claim 8, further comprising if the absolute value of the slopeis less than a threshold function, denying the plurality of subsequentdata packets.
 15. A method for dormant data session reactivation,comprising: a packet control function in a radio access networkreceiving a first data packet having a source IP address, wherein thefirst data packet has a destination IP address coupled to reactivate adormant mobile station coupled to the radio access network; the packetcontrol function receiving a plurality of subsequent data packets havingthe source IP address, wherein each of the plurality of subsequent datapackets has a subsequent destination IP address and a corresponding timestamp; for each of the subsequent destination IP addresses that aresubstantially sequential, evaluating an absolute value of a slope of thedifference between the subsequent destination IP addresses that aresubstantially sequential over a difference in the corresponding timestamps; and if the absolute value of the slope is less than a thresholdfunction, preventing the first data packet from reactivating the dormantmobile station.
 16. The method of claim 15, wherein if the absolutevalue of the slope is less than a threshold function and greater than asecond threshold function, preventing the first packet from reactivatingthe dormant mobile station.
 17. The method of claim 15, wherein theradio access network is a CDMA network.
 18. The method of claim 15,further comprising converting each of the subsequent destination IPaddresses into an ordinal numeric representation.
 19. The method ofclaim 15, further comprising if the absolute value of the slope is lessthan a threshold function, denying the plurality of subsequent datapackets.
 20. The method of claim 15, wherein if the absolute value ofthe slope is not less than the threshold function, sending the firstpacket to the dormant mobile station.